01FOUNDATIONS
In the beginning, there were assets.
And they were scattered across three clouds, two spreadsheets, and one engineer’s memory. An inventory was made, and it was good.
A field guide in parables
The Bible,
but for your threat model.
Ancient stories for modern people who rotate secrets, review pull requests, and still get paged at 03:17.
40 stories
Foundations covers identity, inventory, architecture, governance, and threat framing. Practice covers access, secrets, change, monitoring, and daily discipline. Response covers incidents, disclosure, continuity, recovery, and learning afterward.
Genesis 1 ↗
02IAM
The serpent offered admin access.
It looked convenient. It was accepted without MFA. By sunset, the whole garden had become a production environment.
03DR
Noah planned for the incident everyone else ignored.
He built the recovery environment before the weather changed, tested the doors, and kept the runbook close. Preparation looks dramatic right up until it becomes necessary.
04CHANGE
Abraham paused before executing the irreversible change.
He heard the instruction, checked the context, and found a safer path. Good controls leave room for verification before the point of no return.
05IDENTITY
Jacob learned that identity checks matter.
When the voice, clothing, and name did not line up, the system should have challenged the request. Trusting a familiar workflow is not the same as verifying the user.
06ARCHITECTURE
Babel scaled before it was secure.
Everyone shared one language, one ambition, and one enormous blast radius. Distributed systems arrived as a mercy, along with the need for translation layers.
07BCP
Joseph saw the famine coming and made a plan.
He modelled the bad years, stored what mattered, and kept the country running when the forecast became reality. That is a continuity plan with excellent wardrobe choices.
08TRANSPORT
Moses travelled in a hardened container.
The payload was valuable, the route was dangerous, and the basket needed to float. Secure transport begins with knowing what must arrive safely.
09IDENTITY
Mark the doors. Verify the people.
The first access policy was simple: know who is coming in, make the boundary visible, and do not let an unknown process wander through the house.
10POLICY
The tablets were a policy everyone could read.
Short rules, visible ownership, and consequences for ignoring them. A policy hidden in a folder is just a wish with formatting.
11SHADOW IT
They built a golden calf while the owner was away.
It was shiny, undocumented, and had broad permissions. Shadow systems thrive in the silence between “we should” and “we did.”
12CHANGE
Joshua coordinated the release window.
Everyone moved when the signal arrived, the perimeter was understood, and the plan had no room for improvisation. Big changes need small, clear instructions.
13SECRETS
Samson shared the secret with the wrong person.
The password was personal, memorable, and repeated until it became an incident. A secret is only useful when it stays secret.
14EXPOSURE
Gideon reduced the attack surface.
More people did not make the operation safer. He kept the smallest capable team, simplified the plan, and made the signal unmistakable.
15THIRD PARTY
Ruth worked safely inside someone else’s field.
She followed the local rules, stayed within the boundary, and built trust through consistent behaviour. Vendor access is still access.
16THREAT MODEL
David did not match Goliath’s attack surface.
He chose the tool that fit the problem, understood the distance, and aimed at the exposed point. Threat modelling is often just noticing what the giant forgot to protect.
17CHANGE
Saul shipped the exception and called it obedience.
The change was almost complete, the evidence was inconvenient, and the approval was assumed. Partial compliance is still a failed control.
18IR
Job lost everything in one afternoon.
He had backups, but no runbook. The responders arrived, asked good questions, and wrote down what happened so it could not happen quite the same way again.
19INSIDER RISK
David used privileged access for a private purpose.
The request came from the top, the audit trail existed, and the harm was real. Least privilege protects leaders from becoming the incident.
20VALIDATION
Elijah ran the test in public.
One signal, one clear criterion, and no tolerance for a result that could not be reproduced. Incident claims should meet the same standard as production code.
21GOVERNANCE
Wisdom is knowing what not to expose.
Secrets belong in a vault. Decisions belong in a record. Confidence is not a control.
22DISCLOSURE
Esther escalated the threat before it became the breach.
She gathered evidence, chose the right audience, and made the risk impossible to ignore. Responsible disclosure takes timing as seriously as truth.
23PERIMETER
Nehemiah rebuilt the wall with a tool in one hand.
And a watch in the other. The lesson is not to trust the perimeter forever; it is to repair it while monitoring the people who depend on it.
24DETECTION
The watchman stayed awake.
Not because every shadow was a breach, but because the one time it was, somebody needed to notice before the city did.
25RESILIENCE
Daniel kept his practice when the policy changed.
He did not improvise a new identity under pressure. He followed the control, documented the exception, and kept the window open for the review.
26ALERTING
Jonah ignored the alert and changed regions.
The storm followed. Moving the workload is not the same as resolving the cause, and a muted alert is still an unresolved alert.
27SUPPLY CHAIN
Ezra counted the valuables before the journey.
He recorded what was leaving, assigned responsibility, and checked the inventory when it arrived. Chain of custody is ancient wisdom.
28CALLING
Isaiah answered the call with a clear owner.
The question was not “who can do everything?” It was “who is ready to take responsibility?” Security programs improve when ownership has a name.
29DOCUMENTATION
Habakkuk wrote the vision plainly.
Clear documentation gives a team something to watch for, measure against, and carry forward when the original author is gone.
30APPSEC
Do not leave your secrets in the public repo.
The tempter promised convenience. The commit history remembered forever. Rotate the key, then rotate the process that made the key easy to leak.
31DISCLOSURE
The good Samaritan reported the vulnerability.
He found the broken thing, stopped to help, and told the owner with enough detail to repair it. No parade. Just responsible disclosure.
32REMEDIATION
Zacchaeus turned the finding into remediation.
He did not close the ticket with an apology. He returned what was taken, changed the behaviour, and made the repair measurable.
33AWARENESS
Peter denied the breach three times.
The logs disagreed. The lesson is not to shame the person who clicked; it is to build a system that makes the right action easier next time.
34COMMS
Pentecost turned one message into many clear signals.
The audience was broad, the meaning was understood, and the message travelled without losing its purpose. Security communication is a control too.
35INTEGRITY
Ananias and Sapphira edited the record.
The numbers looked fine until the audit asked a second question. Integrity controls exist because a clean dashboard is not the same thing as a true one.
36ACCESS
Peter left the locked environment without the key.
The guardrails failed, the path opened, and the team still needed to confirm what happened. Unexpected access is a signal, not a miracle to ignore.
37MONITORING
Eutychus fell, and the room responded quickly.
Someone noticed, someone moved, and the group did not spend the first five minutes debating whether the alert was real.
38RECOVERY
Paul’s shipwreck still had a recovery plan.
The vessel was lost, the people were not, and the mission continued from a different shore. Resilience is what remains possible after the original plan sinks.
39TRUST
Philemon received a request with context attached.
The message explained the relationship, the risk, and the desired outcome. Trust is easier to extend when the request is legible.
40RECOVERY
At the end, the logs were opened.
Every hidden thing came to light. The city rebuilt with fewer gates, better signals, and a plan for the next morning.
Field notes
“Name the asset. Verify the identity. Minimize the blast radius.”